After I downloaded the Tails ISO I downloaded gpg4win. I did a quick virus scan of the gpg4win file and my Comodo antivirus said it was a "TrojWare.Win32.Kryptik.AGMN@284730160"! So I had to spend a long time figuring out if it was a false positive or not. At the gpg4win forum there were some vague mentioning about malware warnings and false positives all the way back in 2014, which means nothing has been done to fix this yet!
I eventually found a way to upload the
gpg4win-2.2.5.exe to the Comodo cloud for analysis, which gave a report with a bunch of numbers and stuff and a statement about something "undetected", supposedly that no malware was detected, though it didn't explicitly say that.
No mentioning about gpg4win and trojan neither at the Comodo forum nor anywhere else. Very strange. Maybe I'm one of the very few who bothers to check files for malware after download.
Anyway, I decided to take the risk and install gpg4win and hope for the best. So after I had installed that I followed the instructions located here:
..those that are shown after one clicks the link that says "Using other operating systems".
The link that says "Consult the Gpg4win documentation to import it" doesn't link to anything about importing a key specifically. It only talks about importing certificates.
The correct procedure here must be to simply right-click on the "tails-signing.key" and select "Import keys", which appears to work.
Next step is to verify the signature, but following the instructions don't seem to work properly. There is nothing that says "Decrypt and check" anywhere. The closest thing to choose is "Decrypt and verify" but this function will report the following:
tails-i386-1.4.1.iso.sig: Not enough information to check signature validity.
Signed on 2015-06-29 11:07 with unknown certificate 0xA5091F72C746BA6B163D1C183C83DCB52F699C56. The validity of the signature cannot be verified.
Either it means the signature is wrong or the verification doesn't work or the instructions how to do it is wrong.
My impression of this is that this is only for Tor experts and it's software makers to mess with, because it's way too complicated for normal people, which means people don't stand a chance against NSA. Humanity is damned! >:-|